A collection of independent Python scripts for monitoring Linux system security and investigating potential compromises.
LSMS (Linux Security and Monitoring Scripts) is a collection of Python scripts that help monitor Linux systems for security anomalies and investigate potential compromises. It provides tools to track changes in critical files, detect suspicious processes, and audit system integrity, addressing the need for lightweight, customizable security monitoring without heavy infrastructure.
System administrators, DevOps engineers, and security professionals managing Linux servers who need practical, script-based tools for ongoing security monitoring and post-incident forensics.
Developers choose LSMS for its modular, dependency-light approach—each script is standalone and configurable, making it easy to integrate into existing workflows without complex setups, and it supports multiple notification methods for flexible alerting.
Linux Security and Monitoring Scripts
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Each script operates standalone with its own configuration, allowing selective use without dependencies on others, as emphasized in the README's repository structure and philosophy.
Supports output via console, email, or integration with AlertR for real-time notifications, making it adaptable to various environments, as described in the usage and key features.
Includes checks for cron files, SSH keys, systemd units, hidden executables, kernel modules, and log tampering, addressing multiple security aspects through the listed scripts.
Monitor scripts can be initialized with --init to establish a baseline and use --monitoring to report only new findings, enabling effective tracking of state changes over time, as outlined in the monitoring steps.
Each script requires individual configuration files in the scripts/config/ directory, and setting up notifications like email or AlertR adds layers of setup, which can be time-consuming and error-prone.
No built-in scheduler or daemon; users must manually set up cron jobs as root for periodic monitoring, increasing administrative burden compared to integrated security tools.
For advanced real-time alerts, it relies on AlertR, which is a separate project needing its own setup and maintenance, as noted in the notification channel support.